From: Joerg Micheel (joerg@cs.waikato.ac.nz)
Date: Fri May 04 2001 - 23:27:43 PDT
Bogdan,
On Fri, May 04, 2001 at 01:09:31PM -0300, Luis F Balbinot wrote:
> BG>but the only traces I managed to find were either including an
> BG>interface number, or had just a timestamp (the other notation).
> BG>Maybe I missed some of the files, or didn't search properly through
> BG>the directories, but, anyway, the result is that I couldn't find any
> BG>bi-directional traces.
>
> Traces captured with Coral "merge" both traces (ingress and egress) into a
> single file and make distinction between interface 0 and interface 1.
> Assuming you are using the CoralReef Perl interface, the function
> read_pkt() -- if successful -- returns the number of the interface from
> where the packet was read.
Luis answered most of your question. Please note that there are FDDI
monitors and monitors on fibre optic links in the infrastructure,
which make for the unidirectional and bidirectional traces.
The information is in the README file in ftp://Traces. We have an
updated version, which is work in progress and thus has not been
made public yet. I realize it would help you understanding more
which monitors are of which kind:
http://moat.nlanr.net/PMA/Sites/index.html
We also document syncronization capabilities, which can be important
when doing analysis with the timestamps for inbound and outbound
packets. The clockdrift on the 90 second snapshot is probably
negligable, but there might be a small constant offset between the
two directions as the start of capture is hard to syncronize to the
exact same moment. If in doubt, use traces with the two cards being
syncronized by hardware.
Joerg
-- Joerg B. Micheel Email: <joerg@cs.waikato.ac.nz> WAND and NLANR MOAT Email: <joerg@nlanr.net> The University of Waikato, CompScience Phone: +64 7 8384794 Private Bag 3105 Fax: +64 7 8585095 Hamilton, New Zealand Plan: PMA, TINE and the DAG's
This archive was generated by hypermail 2b30 : Thu Sep 27 2001 - 16:24:41 PDT